QID 982777

QID 982777: Nodejs (npm) Security Update for react-adal (GHSA-7mpx-vg3c-cmr4)

This affects versions of react-adal < 0.5.1. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is caused by how the nonce, session and refresh values are stored in the browser local storage or session storage. Each key is automatically appended by ||. When the received nonce and session keys are generated, the list of values is stored in the browser storage, separated by ||, with || always appended to the end of the list. Since || will always be the last 2 characters of the stored values, an empty string ("") will always be in the list of the valid values. Therefore, if an empty session parameter is provided in the callback URL, and a specially-crafted JWT token contains an nonce value of "" (empty string), then adal.js will consider the JWT token as authentic.

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.

CVSS V3 rated as Critical - 8.2 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

Customers are advised to refer to GHSA-7mpx-vg3c-cmr4 for updates pertaining to this vulnerability.

Vendor References

GHSA-7mpx-vg3c-cmr4 - github.com/advisories/GHSA-7mpx-vg3c-cmr4

CVEs related to QID 982777

CVE-2020-7787 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-7mpx-vg3c-cmr4	react-adal		github.com/advisories/GHSA-7mpx-vg3c-cmr4

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].